CVE-2026-91852

MEDIUM 6.1

Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

CVSS Score

6.1

EPSS Score

0.2%

EPSS Percentile

12th

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CWE	CWE-79
Vendor	apache software foundation
Product	apache sling xss
Published	Sep 23, 2026
Last Updated	Sep 23, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache sling xss

Be the first to know when new medium vulnerabilities affecting apache software foundation apache sling xss are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Sling XSS

0 < 2.4.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sling.apache.org: https://sling.apache.org/news.html lists.apache.org: https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo

Credits

Apache Sling would like to thank the github user n0mi1k, the group of Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat, Ali Javidi Ghasr and Mohammad A. Tayebi and The Apache Software Foundation for reporting this issue